@wdyy/skills 0.1.13 → 0.1.15

package/.well-known/skills/index.json

@@ -7,13 +7,13 @@
     },
     {
       "name": "wdyy-deployment-standard",
-      "description": "为无 CI/CD 的前后端项目生成并验证统一 Docker 交付：使用本地已有基础镜像构建前后端两个独立镜像，分别导出后封装为一个压缩包，数据库直连远程实例，服务器无参数一键部署整个项目栈。Use when 规划、实现、审查或执行人工 Docker 生产交付时。",
+      "description": "为无 CI/CD 的前后端项目生成并验证跨宿主机统一 Docker 交付：在 Linux、macOS Docker Desktop 或 Windows Docker Desktop + WSL2/Linux 容器模式中，使用本地已有基础镜像构建单一 linux/amd64 或 linux/arm64 双镜像包，并在平台匹配的 Linux engine 上以固定端口、容器名、重启策略和 CST（UTC+8）时间整栈运行。Use when 规划、实现、审查或执行跨构建机平台的人工 Docker 生产交付时。",
       "files": ["SKILL.md", "agents/openai.yaml", "reference/docker-delivery-rules.md", "scripts/generate-deployment-files.mjs", "scripts/generate-deployment-files.test.mjs", "scripts/validate-deployment-package.mjs", "scripts/validate-deployment-package.test.mjs", "templates/backend.Dockerfile.template", "templates/frontend.Dockerfile.template", "templates/frontend-container.conf.template", "templates/env.example.template", "templates/deploy.sh.template", "templates/docker-compose.yml", "templates/dockerignore.template"]
     },
     {
       "name": "wdyy-api-standard",
       "description": "根据“获取XX数据”“使用XX接口”等具体需求，定位已登记的接口 reference，并按已确认的接口契约将调用方式写入程序。Use when 需要查询或实现一个已登记接口的数据调用时。",
-      "files": ["SKILL.md", "agents/openai.yaml", "reference/api-demo.md", "reference/api-sms.md"]
+      "files": ["SKILL.md", "agents/openai.yaml", "reference/api-demo.md", "reference/api-his-sql.md", "reference/api-sms.md"]
     },
     {
       "name": "wdyy-bug-record",

package/.well-known/skills/wdyy-api-standard/reference/api-his-sql.md

@@ -0,0 +1,38 @@
+# 接口名称：api-his-sql
+
+# 接口用途：执行 SQL 查询并返回查询结果
+
+# 接口URL：http://172.26.1.64:8999/api/database/query
+
+`POST` 请求，`Content-Type` 为 `application/json`。
+
+# 入参格式：JSON
+
+```json
+{
+  "sql": "SELECT * FROM SS_User WHERE ssusr_name = '示例用户'",
+  "params": []
+}
+```
+
+- `sql`：要执行的 SQL 查询语句。
+- `params`：SQL 查询参数数组；示例 SQL 未使用参数，因此传入空数组。
+
+# 返回值：JSON
+
+```json
+{
+  "data": [
+    {
+      "SSUSR_RowId": 20292,
+      "SSUSR_Initials": "20684",
+      "SSUSR_Name": "马俊"
+    }
+  ],
+  "success": true,
+  "count": 1,
+  "message": "查询执行成功"
+}
+```
+
+# 备注：使用 `POST` 请求调用；将 SQL 查询语句放入 `sql` 字段，将对应的查询参数放入 `params` 数组。

package/.well-known/skills/wdyy-deployment-standard/SKILL.md

@@ -1,13 +1,15 @@
 ---
 name: wdyy-deployment-standard
-description: 为无 CI/CD 的前后端项目生成并验证统一 Docker 交付：使用本地已有基础镜像构建前后端两个独立镜像，分别导出后封装为一个压缩包，数据库直连远程实例，服务器无参数一键部署整个项目栈。Use when 规划、实现、审查或执行人工 Docker 生产交付时。
+description: 为无 CI/CD 的前后端项目生成并验证跨宿主机统一 Docker 交付：在 Linux、macOS Docker Desktop 或 Windows Docker Desktop + WSL2/Linux 容器模式中，使用本地已有基础镜像构建单一 linux/amd64 或 linux/arm64 双镜像包，并在平台匹配的 Linux engine 上以固定端口、容器名、重启策略和 CST（UTC+8）时间整栈运行。Use when 规划、实现、审查或执行跨构建机平台的人工 Docker 生产交付时。
 ---
 
 # 统一 Docker 交付规范
 
 ## Overview
 
-把一个项目作为一个整体交付：本地执行 `./deploy.sh build`，生成前端、后端两个独立镜像并分别导出，最终只产出一个压缩包；工程师人工上传并解压；服务器无参数执行 `./deploy.sh`，一次性加载并部署整个前后端项目栈。
+把一个项目作为一个整体交付：在 Linux、macOS Docker Desktop，或 Windows Docker Desktop + WSL2/Linux 容器模式中执行 `./deploy.sh build`，按 `DOCKER_PLATFORM` 生成前端、后端两个 Linux 单架构镜像并分别导出，最终只产出一个压缩包；工程师人工复制并解压；Docker Server 平台匹配时无参数执行 `./deploy.sh`，一次性加载并部署整个前后端项目栈。
+
+macOS/arm64 宿主机的 Docker Server 平台是 `linux/arm64`。Windows 必须在启用 Docker Desktop 集成的 WSL2 发行版和 Linux 文件系统中执行同一 Bash 脚本，并使用 Linux 容器 engine；不支持原生 PowerShell、Windows 容器模式或 `windows/*` 镜像。
 
 ## Workflow
 
@@ -16,16 +18,23 @@ description: 为无 CI/CD 的前后端项目生成并验证统一 Docker 交付
 3. 运行 `node scripts/generate-deployment-files.mjs --target <目标项目根目录> --write` 生成受版本控制文件并扩充 `.env`、`.env.example` 的部署段。既有生成文件不一致时先展示差异并等待工程师确认，确认后才使用 `--force`。
 4. 在目标项目根执行生成器 `--check`，再运行 `scripts/validate-deployment-package.mjs` 和行为测试。
 5. 本地执行 `./deploy.sh build`；只在全部校验成功后原子替换 `deploy/<PROJECT_NAME>-docker.tar.gz`。
-6. 人工上传并解压压缩包，在服务器解压目录无参数执行 `./deploy.sh`。
+6. 人工复制并解压压缩包，在 Linux 文件系统的解压目录无参数执行 `./deploy.sh`；Windows 场景必须从 WSL2 执行。
 
 ## Fixed Contract
 
 - 构建 `<PROJECT_NAME>_frontend:latest` 与 `<PROJECT_NAME>_backend:latest` 两个独立镜像。
+- 每个交付包只对应 `DOCKER_PLATFORM` 指定的 `linux/amd64` 或 `linux/arm64`；构建机自身平台可以不同，不得回退到构建机原生架构。
 - 分别导出 `frontend-image.tar`、`backend-image.tar`，但只交付一个 `<PROJECT_NAME>-docker.tar.gz`。
 - 构建前检查 `FRONTEND_BASE_IMAGE`、`BACKEND_BASE_IMAGE` 已存在于本地；缺失即失败，不执行 `docker pull`。
+- 宿主机可以是 Linux、macOS 或 Windows，但镜像和 Docker Server 必须是 `linux/amd64` 或 `linux/arm64`；加载前读取 Server OS/架构，无法读取、Windows 容器模式或不等于 `DOCKER_PLATFORM` 时立即失败。
 - Compose 只定义 frontend、backend；数据库通过 `.env` 直连远程实例，不生成数据库容器、数据卷或迁移路径。
 - 服务器无参数命令整体部署；只额外允许 `stop` 和 `status`，不得独立操作单一服务。
 - 前后端直接暴露 `.env` 指定的宿主机端口；两个容器共同挂载项目根 `./logs` 到 `/app/logs`。
+- `FRONTEND_PORT` 同时控制 frontend 宿主机映射和容器 Nginx 监听；`BACKEND_PORT` 同时控制 backend 宿主机映射、Node 监听、健康检查和 frontend 内部代理，不增加重复容器端口变量。
+- frontend 容器和镜像 repository 都命名为 `<PROJECT_NAME>_frontend`，backend 都命名为 `<PROJECT_NAME>_backend`；镜像额外使用 `:latest` 标签。同名容器不属于当前 Compose 项目和服务时必须在加载镜像前失败，不得删除或接管。
+- frontend 与 backend 都使用 `restart: unless-stopped`：意外退出由 Docker 自动重启，`./deploy.sh stop` 人工停止后保持停止，直到再次明确整栈部署。
+- frontend Nginx 使用 `.env` 的 `VITE_API_BASE_URL` 与 `BACKEND_PORT`，把同源 API 请求代理到 Compose `backend` 服务；`VITE_API_BASE_URL` 必须等于 `/${API_PREFIX}`。
+- 根 `.env` 与 `.env.example` 必须严格使用 `TZ=Asia/Shanghai`。构建后、Docker save 前实际探测两个镜像；整栈健康后实际探测两个运行容器，均必须以 24 小时格式输出 `CST +0800`。
 - `.env` 可以进入人工上传的压缩包，但必须被 `.dockerignore` 排除，不得进入镜像。
 
 ## Prohibited
@@ -33,6 +42,7 @@ description: 为无 CI/CD 的前后端项目生成并验证统一 Docker 交付
 - 不得使用镜像仓库 pull、镜像 fallback、数据库容器、数据库迁移、宿主机 Nginx、蓝绿、滚动切流或自动回滚。
 - 不得保留发布账本、版本目录、`release.env`、交互菜单或前后端独立替换命令。
 - 不得上传文件、拉取代码、安装 Docker、固定服务器目录或使用 `source`、`eval` 执行 `.env`。
+- 不得生成 PowerShell 备用脚本、Windows 镜像或自动切换 Docker Desktop engine；Windows 原生容器模式必须明确失败。
 - 不得跳过清单、镜像标签、Compose 服务范围、远程数据库配置或健康状态验证。
 
 ## Verification
@@ -40,8 +50,14 @@ description: 为无 CI/CD 的前后端项目生成并验证统一 Docker 交付
 - [ ] deploy 目录只有一个 `<PROJECT_NAME>-docker.tar.gz`。
 - [ ] 压缩包解压后只含 `.env`、deploy.sh、docker-compose.yml、两个镜像 tar 和 manifest.sha256。
 - [ ] 两个镜像归档各自只含预期的 `latest` 标签。
-- [ ] 构建与服务器 Compose 均禁止 pull，服务器禁止 build。
+- [ ] 单一压缩包不含 macOS AppleDouble、资源叉或扩展属性元数据。
+- [ ] 构建与服务器 Compose 均禁止 pull，服务器禁止 build；基础镜像、构建参数、产出镜像和 Compose 平台均与 `DOCKER_PLATFORM` 一致。
+- [ ] Linux Engine、macOS/arm64 Docker Desktop 与 Windows Docker Desktop + WSL2 场景使用同一包契约；Windows 原生容器模式被拒绝。
+- [ ] Docker Server 平台在加载镜像前通过校验，并严格等于 `DOCKER_PLATFORM`。
 - [ ] Compose 只含 frontend、backend，并使用远程数据库环境变量和根 logs。
+- [ ] Compose 的双向端口都来自 FRONTEND_PORT/BACKEND_PORT；两个固定容器名等于各自镜像 repository，并各使用 `unless-stopped`。
+- [ ] 根 `.env` 严格使用 `TZ=Asia/Shanghai`；两个镜像和两个运行容器的真实时间探测均为 24 小时制 `CST +0800`。
+- [ ] frontend 镜像不包含 `.env`，同源 API 代理能够把真实页面查询转发到 backend。
 - [ ] 无参数部署、stop、status 的实际行为及失败传播通过测试。
 
 任一步失败必须指出具体阶段并返回非零；不得静默跳过、伪造成功或删除上一份成功交付包。

package/.well-known/skills/wdyy-deployment-standard/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "wdyy-deployment-standard"
-  short_description: "统一前后端 Docker 双镜像打包与一键整栈部署"
-  default_prompt: "Use $wdyy-deployment-standard to build two local-only Docker images, package them together, and deploy the full stack in one command."
+  short_description: "跨 Linux、Mac 与 Windows WSL2 生成并验证统一双镜像交付"
+  default_prompt: "Use $wdyy-deployment-standard to build and run a single-target linux/amd64 or linux/arm64 dual-image package on Linux engines, macOS Docker Desktop, or Windows Docker Desktop through WSL2, with deterministic ports, names, restart policy, and CST UTC+8 time."

package/.well-known/skills/wdyy-deployment-standard/reference/docker-delivery-rules.md

@@ -31,10 +31,14 @@ DB_USER=app_user
 DB_PASSWORD=change_me
 DB_NAME=app
 DB_SCHEMA=public
+API_PREFIX=api
+VITE_API_BASE_URL=/api
 PROJECT_NAME=example_project
 DOCKER_BIND_IP=0.0.0.0
+DOCKER_PLATFORM=linux/amd64
 FRONTEND_BASE_IMAGE=nginx:stable
-BACKEND_BASE_IMAGE=node:24-alpine3.24
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
 ```
 
 - `PROJECT_NAME` 只允许小写字母开头，后续使用小写字母、数字或下划线。
@@ -42,21 +46,25 @@ BACKEND_BASE_IMAGE=node:24-alpine3.24
 - `.env` 权限必须为 `0600` 或只读 `0400`。
 - 按数据解析 `.env`；不得 `source`、`eval` 或执行其中内容。
 - `DB_URL` 指向远程数据库主机或地址；部署资产不得把它解释为 Docker 服务名并创建数据库容器。
+- `DOCKER_PLATFORM` 必须为 `linux/amd64` 或 `linux/arm64`，表示当前单一交付包的镜像目标平台，并与运行时 Docker Server 平台一致；不得根据 Linux、macOS、Windows 宿主机或 CPU 自动改写，不得使用 `darwin/*` 或 `windows/*`。
+- `TZ` 必须严格等于 `Asia/Shanghai`，使两个容器统一使用 24 小时制的 CST（UTC+8）；其他合法 IANA 时区也不属于本交付合同。
+- `API_PREFIX` 只允许一个安全路径段，`VITE_API_BASE_URL` 必须严格等于 `/${API_PREFIX}`；生成器在两个键都缺失时加入标准值，存在缺失或冲突时明确失败。
 - `.env.example` 可保留空数据库凭据，但真实 `.env` 构建时必须完整。
 
 ## 3. 本地镜像与构建
 
-基础镜像引用允许使用标签，但必须在构建机本地预先存在。相同标签被人工替换后可能对应不同内容；构建过程不得访问镜像仓库。
+基础镜像引用允许使用标签，但目标架构版本必须在构建机本地预先存在。构建命令可以在 Linux、macOS Docker Desktop，或 Windows Docker Desktop + WSL2/Linux 容器模式中执行，也可以与目标架构不同；Windows 必须从启用 Docker Desktop 集成的 WSL2 发行版和 Linux 文件系统执行，不支持原生 PowerShell 或 Windows 容器模式。相同标签被人工替换后可能对应不同内容，构建过程不得访问镜像仓库或回退到构建机原生架构。
 
 `./deploy.sh build` 必须按顺序：
 
 1. 验证根 `.env`、Dockerfile、Compose 和 `.dockerignore`。
-2. 使用 `docker image inspect` 确认两个基础镜像存在。
-3. 使用 `docker build --pull=false` 构建 `<PROJECT_NAME>_frontend:latest` 与 `<PROJECT_NAME>_backend:latest`。
-4. 分别执行 Docker save，生成 `frontend-image.tar`、`backend-image.tar`。
-5. 复制根 `.env`、deploy.sh、docker-compose.yml，生成覆盖全部包内文件的 `manifest.sha256`。
-6. 验证镜像归档各自只含预期标签，验证完整包结构。
-7. 生成 `deploy/<PROJECT_NAME>-docker.tar.gz`，成功后原子替换同名旧包。
+2. 使用平台感知的 `docker image inspect --platform "$DOCKER_PLATFORM"` 确认两个基础镜像的目标架构版本存在。
+3. 校验本地基础镜像平台与 `DOCKER_PLATFORM` 一致，使用 `docker build --pull=false --platform "$DOCKER_PLATFORM"` 构建 `<PROJECT_NAME>_frontend:latest` 与 `<PROJECT_NAME>_backend:latest`，并校验产出镜像平台。
+4. 对两个产出镜像分别使用 `docker run --rm --pull=never --platform "$DOCKER_PLATFORM"` 探测 `date '+%H %Z %z'`，要求小时为 `00`–`23`、时区为 `CST +0800`。
+5. 分别执行 Docker save，生成 `frontend-image.tar`、`backend-image.tar`。
+6. 复制根 `.env`、deploy.sh、docker-compose.yml，生成覆盖全部包内文件的 `manifest.sha256`。
+7. 验证镜像归档各自只含预期标签，验证完整包结构。
+8. 使用 `COPYFILE_DISABLE=1` 和 `tar --no-xattrs` 排除 macOS AppleDouble、资源叉和扩展属性，生成 `deploy/<PROJECT_NAME>-docker.tar.gz`，成功后原子替换同名旧包。
 
 构建失败必须保留上一份成功压缩包，并清理本次临时目录。不得维护发布账本、版本号、版本目录、`release.env` 或半成品目录。
 
@@ -73,13 +81,14 @@ backend-image.tar
 manifest.sha256
 ```
 
-不得包含源代码、Git、依赖缓存、数据库目录、迁移脚本、秘密副本、符号链接或额外嵌套目录。`.env` 必须保持 owner-only 权限并纳入清单；`.dockerignore` 必须确保 `.env`、秘密、deploy、logs、Git、依赖缓存和虚拟环境不进入镜像构建上下文。
+不得包含源代码、Git、依赖缓存、数据库目录、迁移脚本、秘密副本、符号链接、macOS AppleDouble/扩展属性或额外嵌套目录。`.env` 必须保持 owner-only 权限并纳入清单；`.dockerignore` 必须确保 `.env`、秘密、deploy、logs、Git、依赖缓存和虚拟环境不进入镜像构建上下文。
 
 ## 5. 服务器一键操作
 
-工程师人工上传并解压单一压缩包。服务器部署根由解压后的 deploy.sh 物理路径确定。
+工程师人工复制并解压单一压缩包。部署根由解压后的 deploy.sh 物理路径确定。Windows Docker Desktop 场景必须把包放在 WSL2 Linux 文件系统中；不能满足 `.env` owner-only 权限的 Windows 挂载目录必须失败。复制用的 `.tar.gz` 必须放在部署根外，或在解压后移出部署根；执行 `./deploy.sh` 时，部署根只允许保留压缩包契约中的 6 个文件和运行后生成的 `logs/` 目录。
 
-- `./deploy.sh`：校验 `.env` 权限和内容、清单、两个镜像 tar 及预期标签；加载两个镜像；使用一次 `docker compose up -d --force-recreate --no-build --pull never --wait frontend backend` 整体部署并等待健康。
+- `./deploy.sh`：校验 `.env` 权限和内容、清单、两个镜像 tar 及预期标签；通过 `docker version` 读取 Docker Server OS/架构并要求是与 `DOCKER_PLATFORM` 相等的 Linux engine；检查固定容器名不存在或属于当前 Compose 项目和对应服务；校验通过后才加载两个镜像，再使用一次 `docker compose up -d --force-recreate --no-build --pull never --wait frontend backend` 整体部署并等待健康，最后在两个运行容器中验证 24 小时制 `CST +0800`。
+- 加载后必须再次校验两个镜像与 `DOCKER_PLATFORM` 一致；Compose 的两个服务也必须显式声明同一平台。
 - `./deploy.sh stop`：同时停止 frontend、backend，保留容器、镜像、交付文件和日志。
 - `./deploy.sh status`：输出当前 Compose 项目的服务状态，不改变 Docker 状态。
 
@@ -87,17 +96,19 @@ manifest.sha256
 
 ## 6. Compose、数据库和日志
 
-- Compose 只允许 frontend、backend 两个服务，不设置 `container_name`。
+- Compose 只允许 frontend、backend 两个服务；`container_name` 分别固定为 `${PROJECT_NAME}_frontend`、`${PROJECT_NAME}_backend`，与镜像 repository 相同但不含 `:latest`。
 - 镜像固定为 `${PROJECT_NAME}_frontend:latest`、`${PROJECT_NAME}_backend:latest`，不得提供 fallback。
 - frontend 映射 `${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}`；backend 同理。
-- 两个服务均使用根 `.env`，并挂载 `./logs:/app/logs`。
+- 两个服务都固定使用 `restart: unless-stopped`；意外退出由 Docker 重启，`./deploy.sh stop` 后不得由脚本再次启动。
+- frontend Nginx 把 `${VITE_API_BASE_URL}/...` 原样代理到 `http://backend:${BACKEND_PORT}`；不得硬编码服务器地址或后端端口。
+- 两个服务均使用根 `.env`，显式接收同一 `TZ`，并挂载 `./logs:/app/logs`。
 - backend 直接读取 DB_URL、DB_PORT、DB_USER、DB_PASSWORD、DB_NAME、DB_SCHEMA。
 - Compose 不得定义数据库服务、数据库镜像、数据库 volume、数据库端口映射或迁移任务。
 - 前端 Nginx 日志写入 `/app/logs/frontend-access.log`、`/app/logs/frontend-error.log`；后端遵循 wdyy-logging-standard；部署操作写入 `./logs/deploy.log`。
 
 ## 7. 失败边界
 
-- 基础镜像缺失、清单错误、镜像标签错误、远程数据库配置不完整或任一服务不健康时明确失败。
+- 目标架构基础镜像缺失、Docker Server 平台无法读取或不匹配、Windows 容器模式、同名容器所有权冲突、TZ 不等于 `Asia/Shanghai`、镜像或运行容器时间不是 24 小时制 `CST +0800`、清单错误、镜像标签错误、远程数据库配置不完整或任一服务不健康时明确失败。
 - 禁止 `docker pull`、服务器 `docker build`、镜像 fallback、自动回滚、自动安装和静默跳过。
 - 脚本只操作当前 `PROJECT_NAME` 的 Compose 项目和 frontend、backend 服务，不清理其他项目资源。
 - 旧部署资产由工程师根据实际状态单独迁移；新脚本不得猜测并删除。

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.mjs

@@ -24,7 +24,9 @@ const exampleDefaults = new Map([
   ['BACKEND_URL', '0.0.0.0'], ['BACKEND_PORT', '3000'],
   ['DB_URL', ''], ['DB_PORT', '5432'], ['DB_USER', ''], ['DB_PASSWORD', ''], ['DB_NAME', ''], ['DB_SCHEMA', ''],
 ]);
-const deploymentKeys = ['PROJECT_NAME', 'DOCKER_BIND_IP', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE'];
+const apiKeys = ['API_PREFIX', 'VITE_API_BASE_URL'];
+const legacyDeploymentKeys = ['PROJECT_NAME', 'DOCKER_BIND_IP', 'DOCKER_PLATFORM', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE'];
+const deploymentKeys = [...legacyDeploymentKeys, 'TZ'];
 const removedKeys = new Set([
   'PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
   'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT',
@@ -94,24 +96,54 @@ function parseEnvironment(text, relativePath, requireExampleDefaults, deployment
       }
     }
   }
+  const apiEntries = sections.get('API');
+  const apiValues = new Map(apiEntries.map(({ key, value }) => [key, value]));
+  const presentApiKeys = apiKeys.filter((key) => apiValues.has(key));
+  if (presentApiKeys.length !== 0 && presentApiKeys.length !== apiKeys.length) {
+    throw new Error(`${relativePath} # API must contain both: ${apiKeys.join(', ')}`);
+  }
+  if (presentApiKeys.length === apiKeys.length) {
+    const prefix = apiValues.get('API_PREFIX');
+    const baseUrl = apiValues.get('VITE_API_BASE_URL');
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(prefix)) throw new Error(`${relativePath} API_PREFIX must be one safe path segment`);
+    if (baseUrl !== `/${prefix}`) throw new Error(`${relativePath} VITE_API_BASE_URL must equal /${prefix}`);
+  }
   const deploymentEntries = sections.get('部署');
   const actualDeploymentKeys = deploymentEntries.map(({ key }) => key);
-  if (actualDeploymentKeys.length !== 0 && actualDeploymentKeys.join('|') !== deploymentKeys.join('|')) {
-    throw new Error(`${relativePath} # 部署 keys must be empty or exactly: ${deploymentKeys.join(', ')}`);
+  const deploymentKeySequence = actualDeploymentKeys.join('|');
+  const isEmptyDeployment = actualDeploymentKeys.length === 0;
+  const isLegacyDeployment = deploymentKeySequence === legacyDeploymentKeys.join('|');
+  const isCurrentDeployment = deploymentKeySequence === deploymentKeys.join('|');
+  if (!isEmptyDeployment && !isLegacyDeployment && !isCurrentDeployment) {
+    throw new Error(`${relativePath} # 部署 keys must be empty, the legacy sequence ${legacyDeploymentKeys.join(', ')}, or exactly: ${deploymentKeys.join(', ')}`);
   }
   if (requireExampleDefaults) {
     for (const { key, value } of deploymentEntries) {
       if (value !== deploymentDefaults.get(key)) throw new Error(`${relativePath} must keep the standard deployment default for ${key}`);
     }
   }
+  if (isCurrentDeployment) {
+    const timezone = deploymentEntries.find(({ key }) => key === 'TZ')?.value;
+    if (timezone !== 'Asia/Shanghai') throw new Error(`${relativePath} TZ must equal Asia/Shanghai for CST (UTC+8)`);
+  }
   return {
-    extended: deploymentEntries.length === deploymentKeys.length,
+    apiExtended: presentApiKeys.length === apiKeys.length,
+    deploymentExtended: isCurrentDeployment,
+    presentDeploymentKeys: actualDeploymentKeys,
     nonDeploymentKeys: [...seen].filter((key) => !deploymentKeys.includes(key)),
   };
 }
 
-function extendDeploymentSection(text, deploymentDefaults) {
-  const additions = deploymentKeys.map((key) => `${key}=${deploymentDefaults.get(key)}`).join('\n');
+function extendApiSection(text, apiDefaults) {
+  const additions = apiKeys.map((key) => `${key}=${apiDefaults.get(key)}`).join('\n');
+  return `${text.replaceAll('\r\n', '\n').trimEnd().replace(/^# 部署$/m, `${additions}\n\n# 部署`)}\n`;
+}
+
+function extendDeploymentSection(text, deploymentDefaults, presentDeploymentKeys) {
+  const additions = deploymentKeys
+    .filter((key) => !presentDeploymentKeys.includes(key))
+    .map((key) => `${key}=${deploymentDefaults.get(key)}`)
+    .join('\n');
   return `${text.trimEnd()}\n${additions}\n`;
 }
 
@@ -145,7 +177,8 @@ if (!targetInfo.isDirectory()) throw new Error(`Target project root is not a dir
 
 const deploymentTemplate = await readFile(join(templatesRoot, 'env.example.template'), 'utf8');
 const deploymentDefaults = new Map([...deploymentTemplate.matchAll(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/gm)].map((match) => [match[1], match[2]]));
-if (deploymentKeys.some((key) => !deploymentDefaults.has(key))) throw new Error('Deployment environment template is incomplete');
+if ([...apiKeys, ...deploymentKeys].some((key) => !deploymentDefaults.has(key))) throw new Error('Deployment environment template is incomplete');
+const apiDefaults = new Map(apiKeys.map((key) => [key, deploymentDefaults.get(key)]));
 
 const environmentPlans = [];
 for (const [relativePath, expectedMode, requireDefaults] of [['.env', 0o600, false], ['.env.example', 0o644, true]]) {
@@ -153,10 +186,13 @@ for (const [relativePath, expectedMode, requireDefaults] of [['.env', 0o600, fal
   const existingBuffer = await readRegularFile(path, relativePath);
   const existing = existingBuffer.toString('utf8');
   const parsed = parseEnvironment(existing, relativePath, requireDefaults, deploymentDefaults);
+  let expected = existing;
+  if (!parsed.apiExtended) expected = extendApiSection(expected, apiDefaults);
+  if (!parsed.deploymentExtended) expected = extendDeploymentSection(expected, deploymentDefaults, parsed.presentDeploymentKeys);
   environmentPlans.push({
     path, relativePath, expectedMode,
     existing: existingBuffer,
-    expected: Buffer.from(parsed.extended ? existing : extendDeploymentSection(existing, deploymentDefaults)),
+    expected: Buffer.from(expected),
     nonDeploymentKeys: parsed.nonDeploymentKeys,
   });
 }

package/.well-known/skills/wdyy-deployment-standard/scripts/generate-deployment-files.test.mjs

@@ -71,10 +71,33 @@ test('生成统一 Docker 交付文件并通过确定性检查', async () => {
   }
   assert.equal((await stat(join(root, 'deploy.sh'))).mode & 0o777, 0o755);
   assert.equal((await stat(join(root, '.env'))).mode & 0o777, 0o600);
-  assert.match(await readFile(join(root, '.env'), 'utf8'), /FRONTEND_BASE_IMAGE=nginx:stable/);
-  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-alpine3\.24/);
+  const environment = await readFile(join(root, '.env'), 'utf8');
+  assert.match(environment, /API_URL=\nAPI_PREFIX=api\nVITE_API_BASE_URL=\/api\n\n# 部署/);
+  assert.match(environment, /FRONTEND_BASE_IMAGE=nginx:stable/);
+  assert.match(environment, /DOCKER_PLATFORM=linux\/amd64/);
+  assert.match(environment, /TZ=Asia\/Shanghai/);
+  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-bookworm-slim/);
+  const compose = await readFile(join(root, 'scripts/deployment/docker-compose.yml'), 'utf8');
+  assert.equal((compose.match(/TZ: "\$\{TZ:\?TZ is required\}"/g) ?? []).length, 2);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_frontend"/);
+  assert.match(compose, /container_name: "\$\{PROJECT_NAME:\?PROJECT_NAME is required\}_backend"/);
+  assert.equal((compose.match(/restart: unless-stopped/g) ?? []).length, 2);
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{FRONTEND_PORT\}:\$\{FRONTEND_PORT\}"/);
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{BACKEND_PORT\}:\$\{BACKEND_PORT\}"/);
+  const nginx = await readFile(join(root, 'scripts/deployment/frontend-container.conf.template'), 'utf8');
+  assert.match(nginx, /location \$\{VITE_API_BASE_URL\}\/ \{/);
+  assert.match(nginx, /proxy_pass http:\/\/backend:\$\{BACKEND_PORT\};/);
+  const frontendDockerfile = await readFile(join(root, 'src/frontend/Dockerfile'), 'utf8');
+  assert.match(frontendDockerfile, /ARG VITE_API_BASE_URL/);
+  assert.doesNotMatch(frontendDockerfile, /COPY\s+\.env/);
+  const backendDockerfile = await readFile(join(root, 'src/backend/Dockerfile'), 'utf8');
+  assert.match(backendDockerfile, /pnpm --filter \.\/src\/backend deploy --prod --legacy \/runtime/);
+  assert.match(backendDockerfile, /WORKDIR \/app\n/);
+  assert.match(backendDockerfile, /COPY --from=build \/runtime \.\/src\/backend\//);
+  assert.match(backendDockerfile, /CMD \["node", "src\/backend\/dist\/main\.js"\]/);
   const check = await invoke(root, '--check');
   assert.match(check.stdout, /verified unified Docker delivery files/);
+  assert.match(await readFile(join(root, 'deploy.sh'), 'utf8'), /env COPYFILE_DISABLE=1 tar --no-xattrs -czf "\$candidate"/);
 });
 
 test('扩充部署段时完整保留真实环境值', async () => {
@@ -86,6 +109,112 @@ test('扩充部署段时完整保留真实环境值', async () => {
   assert.match(actual, /PROJECT_NAME=\nDOCKER_BIND_IP=\n/);
 });
 
+test('旧五键部署段只追加标准时区并保留既有值', async () => {
+  const legacyReal = realEnv.replace('# 部署\n', `# 部署
+PROJECT_NAME=custom_project
+DOCKER_BIND_IP=127.0.0.1
+DOCKER_PLATFORM=linux/arm64
+FRONTEND_BASE_IMAGE=custom-nginx:1
+BACKEND_BASE_IMAGE=custom-node:1
+`);
+  const legacyExample = exampleEnv.replace('# 部署\n', `# 部署
+PROJECT_NAME=
+DOCKER_BIND_IP=
+DOCKER_PLATFORM=linux/amd64
+FRONTEND_BASE_IMAGE=nginx:stable
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+`);
+  const root = await fixture(legacyReal, legacyExample);
+  await invoke(root, '--write');
+  const actual = await readFile(join(root, '.env'), 'utf8');
+  assert.match(actual, /PROJECT_NAME=custom_project/);
+  assert.match(actual, /DOCKER_PLATFORM=linux\/arm64/);
+  assert.match(actual, /BACKEND_BASE_IMAGE=custom-node:1\nTZ=Asia\/Shanghai\n$/);
+  assert.match(await readFile(join(root, '.env.example'), 'utf8'), /BACKEND_BASE_IMAGE=node:24-bookworm-slim\nTZ=Asia\/Shanghai\n$/);
+  await invoke(root, '--check');
+});
+
+test('非标准时区默认值和无效部署键顺序被拒绝且不修改', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const examplePath = join(root, '.env.example');
+  const invalidTimezoneExample = (await readFile(examplePath, 'utf8')).replace('TZ=Asia/Shanghai', 'TZ=UTC');
+  await writeFile(examplePath, invalidTimezoneExample, { mode: 0o644 });
+  const before = await readFile(examplePath);
+  await assert.rejects(invoke(root, '--write'), /standard deployment default for TZ/);
+  assert.deepEqual(await readFile(examplePath), before);
+
+  const invalidOrder = realEnv.replace('# 部署\n', `# 部署
+TZ=Asia/Shanghai
+PROJECT_NAME=example_project
+DOCKER_BIND_IP=0.0.0.0
+DOCKER_PLATFORM=linux/amd64
+FRONTEND_BASE_IMAGE=nginx:stable
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+`);
+  await assert.rejects(invoke(await fixture(invalidOrder), '--write'), /# 部署 keys must be/);
+});
+
+test('真实环境必须固定 Asia/Shanghai 且失败时不修改受控文件', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const envPath = join(root, '.env');
+  const invalid = (await readFile(envPath, 'utf8')).replace('TZ=Asia/Shanghai', 'TZ=UTC');
+  await writeFile(envPath, invalid, { mode: 0o600 });
+  const beforeEnv = await readFile(envPath);
+  const beforeDeploy = await readFile(join(root, 'deploy.sh'));
+  await assert.rejects(invoke(root, '--write'), /TZ must equal Asia\/Shanghai for CST \(UTC\+8\)/);
+  assert.deepEqual(await readFile(envPath), beforeEnv);
+  assert.deepEqual(await readFile(join(root, 'deploy.sh')), beforeDeploy);
+});
+
+test('非默认应用端口保持单一来源且宿主机变量不改写镜像平台', async () => {
+  const configured = realEnv
+    .replace('FRONTEND_PORT=5173', 'FRONTEND_PORT=18080')
+    .replace('BACKEND_PORT=3000', 'BACKEND_PORT=19090')
+    .replace('# 部署\n', `# 部署
+PROJECT_NAME=desktop_project
+DOCKER_BIND_IP=127.0.0.1
+DOCKER_PLATFORM=linux/arm64
+FRONTEND_BASE_IMAGE=nginx:stable
+BACKEND_BASE_IMAGE=node:24-bookworm-slim
+TZ=Asia/Shanghai
+`);
+  const root = await fixture(configured);
+  await invoke(root, '--write');
+  const actual = await readFile(join(root, '.env'), 'utf8');
+  assert.match(actual, /FRONTEND_PORT=18080/);
+  assert.match(actual, /BACKEND_PORT=19090/);
+  assert.match(actual, /DOCKER_PLATFORM=linux\/arm64/);
+  const compose = await readFile(join(root, 'scripts/deployment/docker-compose.yml'), 'utf8');
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{FRONTEND_PORT\}:\$\{FRONTEND_PORT\}"/);
+  assert.match(compose, /"\$\{DOCKER_BIND_IP\}:\$\{BACKEND_PORT\}:\$\{BACKEND_PORT\}"/);
+  assert.doesNotMatch(compose, /18080|19090|FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT/);
+});
+
+test('保留有效的自定义 API 路径', async () => {
+  const configuredReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=service\nVITE_API_BASE_URL=/service\n');
+  const configuredExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=service\nVITE_API_BASE_URL=/service\n');
+  const root = await fixture(configuredReal, configuredExample);
+  await invoke(root, '--write');
+  assert.match(await readFile(join(root, '.env'), 'utf8'), /API_PREFIX=service\nVITE_API_BASE_URL=\/service/);
+  await invoke(root, '--check');
+});
+
+test('缺失、非法或冲突的 API 路径被明确拒绝', async () => {
+  const partialReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\n');
+  const partialExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\n');
+  await assert.rejects(invoke(await fixture(partialReal, partialExample), '--write'), /must contain both/);
+
+  const invalidReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api/path\nVITE_API_BASE_URL=/api\/path\n');
+  const invalidExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api/path\nVITE_API_BASE_URL=/api\/path\n');
+  await assert.rejects(invoke(await fixture(invalidReal, invalidExample), '--write'), /one safe path segment/);
+
+  const conflictReal = realEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\nVITE_API_BASE_URL=/service\n');
+  const conflictExample = exampleEnv.replace('API_URL=\n', 'API_URL=\nAPI_PREFIX=api\nVITE_API_BASE_URL=/service\n');
+  await assert.rejects(invoke(await fixture(conflictReal, conflictExample), '--write'), /VITE_API_BASE_URL must equal \/api/);
+});
+
 test('非标准环境文件被拒绝且不修改', async () => {
   const invalid = realEnv.replace('# 数据库\n', '');
   const root = await fixture(invalid);
@@ -95,6 +224,23 @@ test('非标准环境文件被拒绝且不修改', async () => {
   await assert.rejects(stat(join(root, 'deploy.sh')), { code: 'ENOENT' });
 });
 
+test('旧后端基础镜像默认值被拒绝且两个环境文件均不修改', async () => {
+  const root = await fixture();
+  await invoke(root, '--write');
+  const envPath = join(root, '.env');
+  const examplePath = join(root, '.env.example');
+  const configuredEnv = (await readFile(envPath, 'utf8')).replace('node:24-bookworm-slim', 'node:24-alpine3.24');
+  const outdatedExample = (await readFile(examplePath, 'utf8')).replace('node:24-bookworm-slim', 'node:24-alpine3.24');
+  await writeFile(envPath, configuredEnv, { mode: 0o600 });
+  await writeFile(examplePath, outdatedExample, { mode: 0o644 });
+  const beforeEnv = await readFile(envPath);
+  const beforeExample = await readFile(examplePath);
+
+  await assert.rejects(invoke(root, '--write'), /must keep the standard deployment default for BACKEND_BASE_IMAGE/);
+  assert.deepEqual(await readFile(envPath), beforeEnv);
+  assert.deepEqual(await readFile(examplePath), beforeExample);
+});
+
 test('环境变量集合不一致时拒绝修改', async () => {
   const root = await fixture(realEnv, exampleEnv.replace('API_URL=', 'API_URL=\nAPI_TOKEN='));
   await assert.rejects(invoke(root, '--write'), /variable names must remain consistent/);

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -55,7 +55,7 @@ const envText = await readFile(join(packageRoot, '.env'), 'utf8');
 const env = parseDotenv(envText);
 const sections = [...envText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
 assert(sections.join('|') === '前端|后端|数据库|API|部署', 'Root .env must use the five standard sections in order');
-for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_URL', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'DB_SCHEMA', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+for (const key of ['FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'API_PREFIX', 'VITE_API_BASE_URL', 'DB_URL', 'DB_PORT', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'DB_SCHEMA', 'PROJECT_NAME', 'DOCKER_BIND_IP', 'DOCKER_PLATFORM', 'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE', 'TZ']) {
   assert(env.get(key), `Root .env is missing ${key}`);
 }
 assert(/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME')), 'Invalid PROJECT_NAME');
@@ -64,6 +64,10 @@ for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT']) {
   assert(Number.isInteger(port) && port >= 1 && port <= 65535, `${key} must be a valid port`);
 }
 assert(env.get('FRONTEND_PORT') !== env.get('BACKEND_PORT'), 'Frontend and backend ports must differ');
+assert(/^[A-Za-z][A-Za-z0-9_-]*$/.test(env.get('API_PREFIX')), 'API_PREFIX must be one safe path segment');
+assert(env.get('VITE_API_BASE_URL') === `/${env.get('API_PREFIX')}`, 'VITE_API_BASE_URL must equal /API_PREFIX');
+assert(/^(?:linux\/amd64|linux\/arm64)$/.test(env.get('DOCKER_PLATFORM')), 'Invalid DOCKER_PLATFORM');
+assert(env.get('TZ') === 'Asia/Shanghai', 'Invalid TZ; expected Asia/Shanghai for CST (UTC+8)');
 for (const key of env.keys()) {
   assert(!['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT', 'SERVER_PROJECTS_ROOT', 'NGINX_SOURCE', 'LOG_DIR', 'HOST_LOG_DIR', 'FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST', 'DATABASE_MIGRATION_MODE', 'MIGRATIONS_SOURCE', 'MIGRATION_RUNNER_SOURCE', 'RELEASE_VERSION'].includes(key) && !/_(?:HEALTH|VERSION)_URL$/.test(key), `Root .env contains removed configuration: ${key}`);
 }
@@ -77,15 +81,35 @@ for (const [pattern, message] of [
   [/"\$1" == status/, 'Missing status command'],
   [/docker image inspect "\$FRONTEND_BASE_IMAGE"/, 'Frontend local base image must be checked'],
   [/docker image inspect "\$BACKEND_BASE_IMAGE"/, 'Backend local base image must be checked'],
-  [/docker build --pull=false/g, 'Docker builds must disable pull'],
+  [/docker build --pull=false --platform "\$DOCKER_PLATFORM"/g, 'Docker builds must use the configured target platform and disable pull'],
   [/docker save -o "\$package_root\/frontend-image\.tar"/, 'Frontend image must be exported separately'],
   [/docker save -o "\$package_root\/backend-image\.tar"/, 'Backend image must be exported separately'],
+  [/env COPYFILE_DISABLE=1 tar --no-xattrs -czf "\$candidate"/, 'Delivery archive must exclude macOS metadata and extended attributes'],
+  [/docker version --format '\{\{\.Server\.Os\}\}\/\{\{\.Server\.Arch\}\}'/, 'Deploy must read the Docker Server platform'],
+  [/Windows container mode is unsupported; switch Docker Desktop to Linux containers/, 'Deploy must reject Windows container mode explicitly'],
+  [/assert_stack_container_ownership/, 'Deploy must validate fixed container name ownership'],
+  [/assert_image_cst_time "\$frontend_image"/, 'Frontend built image CST time must be checked'],
+  [/assert_image_cst_time "\$backend_image"/, 'Backend built image CST time must be checked'],
+  [/assert_container_cst_time "\$\{PROJECT_NAME\}_frontend"/, 'Running frontend CST time must be checked'],
+  [/assert_container_cst_time "\$\{PROJECT_NAME\}_backend"/, 'Running backend CST time must be checked'],
   [/compose up -d --force-recreate --no-build --pull never --wait frontend backend/, 'Deploy must recreate and wait for both services without build or pull'],
   [/compose stop frontend backend/, 'Stop must target both services'],
   [/compose ps frontend backend/, 'Status must inspect both services'],
 ]) assert(pattern.test(deploy), message);
-assert((deploy.match(/docker build --pull=false/g) ?? []).length === 2, 'Exactly two Docker builds must disable pull');
+assert((deploy.match(/docker build --pull=false --platform "\$DOCKER_PLATFORM"/g) ?? []).length === 2, 'Exactly two Docker builds must use the configured target platform and disable pull');
+const deployStackIndex = deploy.indexOf('deploy_stack() {');
+const serverPlatformCheckIndex = deploy.indexOf('  assert_server_platform\n', deployStackIndex);
+const ownershipCheckIndex = deploy.indexOf('  assert_stack_container_ownership\n', deployStackIndex);
+const firstImageLoadIndex = deploy.indexOf('  docker load -i ', deployStackIndex);
+const composeUpIndex = deploy.indexOf('  compose up -d --force-recreate --no-build --pull never --wait frontend backend', deployStackIndex);
+const runningTimeCheckIndex = deploy.indexOf('  assert_container_cst_time "${PROJECT_NAME}_frontend"', deployStackIndex);
+assert(deployStackIndex >= 0 && serverPlatformCheckIndex > deployStackIndex && ownershipCheckIndex > serverPlatformCheckIndex && firstImageLoadIndex > ownershipCheckIndex, 'Docker Server platform and container ownership must be checked before loading images');
+assert(composeUpIndex > firstImageLoadIndex && runningTimeCheckIndex > composeUpIndex, 'Running container CST time must be checked after Compose health wait');
+const frontendImageTimeIndex = deploy.indexOf('  assert_image_cst_time "$frontend_image"');
+const firstImageSaveIndex = deploy.indexOf('  docker save -o "$package_root/frontend-image.tar"');
+assert(frontendImageTimeIndex >= 0 && firstImageSaveIndex > frontendImageTimeIndex, 'Built image CST time must be checked before Docker save');
 assert(!/\bdocker\s+pull\b/.test(deploy), 'docker pull is forbidden');
+assert(!/\bdocker\s+(?:start|restart)\b/.test(deploy), 'Deployment script must not restart manually stopped containers outside explicit Compose deploy');
 assert(!/\bsource\s+[^\n]*\.env|\beval\b/.test(deploy), 'Environment files must be parsed as data');
 assert(!/server_menu|运行或替换|read_release_pointer|release_ledger|AGENTS\.md/.test(deploy), 'Legacy menu or release ledger logic is forbidden');
 assert(!/\bpsql\b|\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy), 'Database, upload or source-pull commands are forbidden');
@@ -95,11 +119,19 @@ const serviceNames = [...compose.matchAll(/^  ([a-z][a-z0-9_-]*):$/gm)].map((mat
 assert(JSON.stringify(serviceNames) === JSON.stringify(['frontend', 'backend']), `Compose must define only frontend and backend; got ${serviceNames.join(', ')}`);
 assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend:latest"'), 'Compose frontend image is not fixed');
 assert(compose.includes('image: "${PROJECT_NAME:?PROJECT_NAME is required}_backend:latest"'), 'Compose backend image is not fixed');
+assert(compose.includes('container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_frontend"'), 'Compose frontend container name must equal its image repository');
+assert(compose.includes('container_name: "${PROJECT_NAME:?PROJECT_NAME is required}_backend"'), 'Compose backend container name must equal its image repository');
+assert((compose.match(/platform: "\$\{DOCKER_PLATFORM:\?DOCKER_PLATFORM is required\}"/g) ?? []).length === 2, 'Both services must use DOCKER_PLATFORM');
 assert((compose.match(/env_file: \.\/\.env/g) ?? []).length === 2, 'Both services must use root .env');
+assert((compose.match(/TZ: "\$\{TZ:\?TZ is required\}"/g) ?? []).length === 2, 'Both services must explicitly use the same required TZ');
+assert((compose.match(/restart: unless-stopped/g) ?? []).length === 2, 'Both services must use restart: unless-stopped');
 assert((compose.match(/^\s*- \.\/logs:\/app\/logs\s*$/gm) ?? []).length === 2, 'Both services must mount root logs');
 assert(compose.includes('"${DOCKER_BIND_IP}:${FRONTEND_PORT}:${FRONTEND_PORT}"'), 'Frontend port mapping is invalid');
 assert(compose.includes('"${DOCKER_BIND_IP}:${BACKEND_PORT}:${BACKEND_PORT}"'), 'Backend port mapping is invalid');
-assert(!/container_name:|\b(?:postgres|database|db):\s*$|postgres:\d|DATABASE_MIGRATION|MIGRATIONS_SOURCE|RELEASE_VERSION|blue|green/i.test(compose), 'Compose contains a database, migration, release or blue-green configuration');
+assert(compose.includes('VITE_API_BASE_URL: "${VITE_API_BASE_URL:?VITE_API_BASE_URL is required}"'), 'Frontend API path is not passed to Nginx');
+assert(compose.includes('BACKEND_PORT: "${BACKEND_PORT:?BACKEND_PORT is required}"'), 'Backend port is not passed to Nginx');
+assert(compose.includes('NGINX_ENVSUBST_FILTER: "^(FRONTEND_URL|FRONTEND_PORT|VITE_API_BASE_URL|BACKEND_PORT)$"'), 'Nginx envsubst filter does not cover the runtime API proxy');
+assert(!/\b(?:postgres|database|db):\s*$|postgres:\d|DATABASE_MIGRATION|MIGRATIONS_SOURCE|RELEASE_VERSION|blue|green/i.test(compose), 'Compose contains a database, migration, release or blue-green configuration');
 
 const manifestText = await readFile(join(packageRoot, 'manifest.sha256'), 'utf8');
 const manifestEntries = new Map();
@@ -122,6 +154,9 @@ async function assertImageArchive(name, expectedTag) {
   const parsed = JSON.parse(stdout);
   assert(Array.isArray(parsed) && parsed.length === 1, `${name} must contain exactly one image manifest`);
   assert(JSON.stringify(parsed[0].RepoTags) === JSON.stringify([expectedTag]), `${name} must contain only ${expectedTag}`);
+  const { stdout: configText } = await run('tar', ['-xOf', archive, parsed[0].Config], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024 });
+  const config = JSON.parse(configText);
+  assert(`${config.os}/${config.architecture}` === env.get('DOCKER_PLATFORM'), `${name} platform must equal DOCKER_PLATFORM`);
 }
 await assertImageArchive('frontend-image.tar', `${env.get('PROJECT_NAME')}_frontend:latest`);
 await assertImageArchive('backend-image.tar', `${env.get('PROJECT_NAME')}_backend:latest`);